Bounty Economics

What the numbers are. Each programme's advertised maximum payout, which this page calls its ceiling; whether it promises safe harbour to a researcher who tests in good faith; how many hours HackerOne programmes take to answer, pay and resolve; and how many programmes are live on the two web3 platforms. Every figure names the number of programmes it was computed from. A median is the middle value, and percentiles use linear interpolation over the programmes publishing a non-zero ceiling.

Where they come from. HackerOne, Bugcrowd, Intigriti, YesWeHack and Federacy come from arkadiyt/bounty-targets-data, an MIT-licensed mirror of the platforms' own directory data refreshed every thirty minutes; this page uses the pull of 11 September 2026. Immunefi and Cantina each publish a public endpoint, read directly on 19 September 2026. YFarmX computes every aggregate from those files, and all seven platform records carry the marker Confirmed.

What they say. Across 1,178 programmes on seven platforms, the median Bugcrowd ceiling is $4,000 across the 273 of 278 programmes that publish one, 71 of 278 Bugcrowd programmes give less than full safe harbour, HackerOne's median report resolves in 1,174.5 hours, and Immunefi's median advertised ceiling is $100,000 across 170 live programmes.

The caveats. A ceiling is what a programme advertises, and the amount it will pay can be lower: 140 of Immunefi's 747 reward rows cap a critical at 10 per cent of the funds at risk. Asset counts are of machine-readable entries only: 14 of the 51 live Cantina programmes publish scope as prose, and the SpaceX/Starlink record on Bugcrowd carries one in-scope entry pointing at the human-readable brief. Intigriti's medians are kept per currency, €2,500 across 50 programmes, $9,250 across 18 and one at £12,500, because pooling euros, dollars and sterling produces a sort-order artefact, and YesWeHack publishes its 57 figures as bare numbers, so they are shown without a currency.

The dates in the log. Immunefi rows carry the programme's own launch date and Cantina rows the start of the timeframe the platform publishes, 221 rows in all. The five mirrored platforms publish no programme date, so their 957 rows carry 11 September 2026, the day they entered this index, and they follow the dated programmes when the log is in its default order.

Reproduce it. One pull and one parse gives the Bugcrowd figures:

curl -sSL -o bugcrowd.json https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/bugcrowd_data.json
python3 -c "import json,statistics; d=json.load(open('bugcrowd.json')); m=[p['max_payout'] for p in d if p.get('max_payout')]; print(len(d), len(m), statistics.median(m), max(m))"

Read the field a hunter reads first on reading a bounty scope, and each platform's record under its name at the foot of the page.